Many years ago I started to describe how it works in an HN comment and some reply complained about the idea of terminating TLS, i.e., decrypting, and then re-encrypting. Obviously this sacrifices something, e.g, speed, in order to gain _control_
But this is what Cloudflare does and no one seems to mind
Large companies also do this to protect their LANs
I'm not running a CDN, only a small home LAN. I'm only procesing a small amount of traffic on a personal computer. This setup is fast enough for me, it's not slow at all
The basic configuration is generally:
1. Configure DNS to point to the local proxy listening address #1, a local address, e.g., using a wildcard in a zone file
2. Configure the proxy to terminate TLS, "do stuff", and then forward to proxy UNIX socket path #2 or proxy listening address #2
3. After doing the stuff, the proxy then sends the traffic over the internet
The "do stuff" part is personal. It depends on what one wants to do. There are seemingly endless possibilities
It's not likely the constantly changing configurations I use would be suitable for others. It's all based on personal preferences and usage habits
I rarely use a graphical browser, for example
I don't make piecemeal remote DNS queries like most www users. (IME, most A RR's stay the same over long periods.) I get bulk DNS data periodicallly from a variety of sources and load it into the proxy's memory. When I make an HTTP request there is either no DNS lookup because I'm using the IP address of the proxy or there is a single, local DNS lookup which returns the address of the proxy. There is no access to remote DNS
When I first decided to start inspecting own TLS traffic by terminating and re-encrypting, I initially tested the idea using socat
After I saw that it worked, I started using other software like haproxy
I never expected this approach would work well enough but many years have gone by and I'm still using it. The configurations I use are much longer and more complicated than any sample I have ever seen on the www
It's funny that Cloudflare is decrypting and re-encryting _other peoples'_ traffic, and this is thought to be AOK, but aside from large companies few people seem interested in doing this with their _own_ traffic on their _own_ computers on their _own_ networks
NB. I actually do not encrypt then re-encrypt for the majority of HTTP requests I make
I generate HTTP myself using own programs and connect to the localhost proxy using various TCP clients. The proxy does the encryption and remote connections not the client programs
I process response bodies, using own software, into SQL, CSV, simple HTML or plain text
This design isn't for everybody, but it's what I strongly prefer
In the way I use it, for the majority of HTTP traffic, no speed is sacrificed
There are a variety of proxies that can be used to forward traffic. I use only a small selection, haproxy is the largest, tinyproxy is the smallest. Personal preference will vary
The local DNS setup is just habit. I have been using djbdns and a custom root.zone for a very long time, before "privacy" was the issue it is today, and I have own particular prefences; every user is different. Using a firewall to send traffic to the proxy is an alternative. The motivation for me was always experimentation, learning and control, not "privacy"
"Privacy" is something one could aim for, if one has _control_. But IMHO without control, "privacy" is nothing more than marketing
This sounds like exactly the kind of thing I'd waste a weekend setting up but what do you actually do with the decrypted traffic? What do you inject? I know you said it's personal but maybe some basic ideas.
Do you find any websites or services that fail because of cert pinning or similar? Why do you restrict dns caching to periodic intervals, just for external privacy?
In terms of the speed I doubt the time to decrypt and encrypt tls is noticeable in modern times, especially given how slow websites have become. It's not like a load balanced website behind cloudflare isn't already doing this 3 times
How much speed are you actually sacrificing? I'd assume modern hardware can decrypt/encrypt TLS very fast.
Side note: I remember working for a company in early 2000's that had Sparc III 1U servers we had to buy crypto accelerators to do this until I had to convince them to use dell/linux.
Many years ago I started to describe how it works in an HN comment and some reply complained about the idea of terminating TLS, i.e., decrypting, and then re-encrypting. Obviously this sacrifices something, e.g, speed, in order to gain _control_
But this is what Cloudflare does and no one seems to mind
Large companies also do this to protect their LANs
I'm not running a CDN, only a small home LAN. I'm only procesing a small amount of traffic on a personal computer. This setup is fast enough for me, it's not slow at all
The basic configuration is generally:
1. Configure DNS to point to the local proxy listening address #1, a local address, e.g., using a wildcard in a zone file
2. Configure the proxy to terminate TLS, "do stuff", and then forward to proxy UNIX socket path #2 or proxy listening address #2
3. After doing the stuff, the proxy then sends the traffic over the internet
The "do stuff" part is personal. It depends on what one wants to do. There are seemingly endless possibilities
It's not likely the constantly changing configurations I use would be suitable for others. It's all based on personal preferences and usage habits
I rarely use a graphical browser, for example
I don't make piecemeal remote DNS queries like most www users. (IME, most A RR's stay the same over long periods.) I get bulk DNS data periodicallly from a variety of sources and load it into the proxy's memory. When I make an HTTP request there is either no DNS lookup because I'm using the IP address of the proxy or there is a single, local DNS lookup which returns the address of the proxy. There is no access to remote DNS
When I first decided to start inspecting own TLS traffic by terminating and re-encrypting, I initially tested the idea using socat
After I saw that it worked, I started using other software like haproxy
I never expected this approach would work well enough but many years have gone by and I'm still using it. The configurations I use are much longer and more complicated than any sample I have ever seen on the www
It's funny that Cloudflare is decrypting and re-encryting _other peoples'_ traffic, and this is thought to be AOK, but aside from large companies few people seem interested in doing this with their _own_ traffic on their _own_ computers on their _own_ networks
It can be useful, IMHO
NB. I actually do not encrypt then re-encrypt for the majority of HTTP requests I make
I generate HTTP myself using own programs and connect to the localhost proxy using various TCP clients. The proxy does the encryption and remote connections not the client programs
I process response bodies, using own software, into SQL, CSV, simple HTML or plain text
This design isn't for everybody, but it's what I strongly prefer
In the way I use it, for the majority of HTTP traffic, no speed is sacrificed
There are a variety of proxies that can be used to forward traffic. I use only a small selection, haproxy is the largest, tinyproxy is the smallest. Personal preference will vary
The local DNS setup is just habit. I have been using djbdns and a custom root.zone for a very long time, before "privacy" was the issue it is today, and I have own particular prefences; every user is different. Using a firewall to send traffic to the proxy is an alternative. The motivation for me was always experimentation, learning and control, not "privacy"
"Privacy" is something one could aim for, if one has _control_. But IMHO without control, "privacy" is nothing more than marketing
This sounds like exactly the kind of thing I'd waste a weekend setting up but what do you actually do with the decrypted traffic? What do you inject? I know you said it's personal but maybe some basic ideas.
Do you find any websites or services that fail because of cert pinning or similar? Why do you restrict dns caching to periodic intervals, just for external privacy?
In terms of the speed I doubt the time to decrypt and encrypt tls is noticeable in modern times, especially given how slow websites have become. It's not like a load balanced website behind cloudflare isn't already doing this 3 times
Just out of curiosity, which proxy do you use?
How much speed are you actually sacrificing? I'd assume modern hardware can decrypt/encrypt TLS very fast.
Side note: I remember working for a company in early 2000's that had Sparc III 1U servers we had to buy crypto accelerators to do this until I had to convince them to use dell/linux.